Widanage Chathura, Liu Weijie, Li Jiayu, Chen Hongbo, Wang XiaoFeng, Tang Haixu, Fox Judy
Indiana University.
University of Virginia.
IEEE Int Conf Cloud Comput. 2021 Sep;2021:733-743. doi: 10.1109/CLOUD53861.2021.00098. Epub 2021 Nov 13.
Trusted execution environments (TEE) such as Intel's Software Guard Extension (SGX) have been widely studied to boost security and privacy protection for the computation of sensitive data such as human genomics. However, a performance hurdle is often generated by SGX, especially from the small enclave memory. In this paper, we propose a new Hybrid Secured Flow framework (called "HySec-Flow") for large-scale genomic data analysis using SGX platforms. Here, the data-intensive computing tasks can be partitioned into independent subtasks to be deployed into distinct secured and non-secured containers, therefore allowing for parallel execution while alleviating the limited size of Page Cache (EPC) memory in each enclave. We illustrate our contributions using a workflow supporting indexing, alignment, dispatching, and merging the execution of SGX- enabled containers. We provide details regarding the architecture of the trusted and untrusted components and the underlying Scorn and Graphene support as generic shielding execution frameworks to port legacy code. We thoroughly evaluate the performance of our privacy-preserving reads mapping algorithm using real human genome sequencing data. The results demonstrate that the performance is enhanced by partitioning the time-consuming genomic computation into subtasks compared to the conventional execution of the data-intensive reads mapping algorithm in an enclave. The proposed HySec-Flow framework is made available as an open-source and adapted to the data-parallel computation of other large-scale genomic tasks requiring security and scalable computational resources.
诸如英特尔软件防护扩展（SGX）之类的可信执行环境（TEE）已得到广泛研究，以增强对人类基因组学等敏感数据计算的安全性和隐私保护。然而，SGX常常会带来性能障碍，尤其是来自小的飞地内存。在本文中，我们提出了一种新的混合安全流框架（称为“HySec-Flow”），用于使用SGX平台进行大规模基因组数据分析。在这里，数据密集型计算任务可以被划分为独立的子任务，以部署到不同的安全和非安全容器中，从而允许并行执行，同时缓解每个飞地中页面缓存（EPC）内存有限的问题。我们使用一个支持索引、比对、调度和合并启用SGX的容器执行的工作流程来说明我们的贡献。我们提供了关于可信和不可信组件的架构以及底层Scorn和Graphene支持的详细信息，作为移植遗留代码的通用屏蔽执行框架。我们使用真实的人类基因组测序数据全面评估了我们的隐私保护读段比对算法的性能。结果表明，与在飞地中传统执行数据密集型读段比对算法相比，将耗时的基因组计算划分为子任务可提高性能。所提出的HySec-Flow框架作为开源框架提供，并适用于其他需要安全和可扩展计算资源的大规模基因组任务的数据并行计算。
